6 ms·

The problem though, for people who want to use WordPress, is that WP sites fundamentally rely on wordpress.org for downloading and installing plugins and themes

The problem though, for people who want to use WordPress, is that WP sites fundamentally rely on wordpress.org for downloading and installing plugins and themes, and critically for security updates to plugins and themes. (You can install/update manually, but the standard admin dashbord is set up to make wordpress.org integration by far the best way to do so.) Yeah, you've got your GPL copy of all the source code. But next week's discovery of vulnerabilities in whatever random plugin gets to be this weeks news means you need to download/install the updated version. Which canonically is found at wordpress.org. We host a couple of dozen sites on WPEngine (and have done for about a decade, very happily with the price, features, and service). Our internal business continuity planning is now investigating ClassicPress, keeping an eye on comms from WPEngine to see what their path forward in terms of keeping WP sites updated without wordpress.org access, and questioning whether it's time to stop using WordPress at all. We already have a few sites that use WP as the admin/publishing tool, and generate the site as static html for hosting via S3/CloudFront - we may make that our standard deployment bit if we had to move all our WP sites off WPE, we may as well investigate other newer tools. We are certainly having conversations right now with potential new clients warning them of the drama in the WordPress ownership/ecosystem, and advising considering alternative options or at least waiting until the dust settles on Matt's current ill advised crusade.

mingus88 2y ago
The update issue doesn’t sound like a big deal. What’s stopping WP Engine from setting up their own mirror system? CentOS did this to Redhat for decades. They literally stripped out the trademarks and distributed the OS to anyone with no contracts at all. Patches were available same day that RH published them, and were applied from CentOS update servers. The endgame for WP seems to be that they give up this fight or close their source and act like a real licensed software company. You can’t play GPL until it no longer suits you, then start making insane demands about revenue sharing and all this nonsense.
- bigiain 2y ago
  WPEngine do have their own mirrors. This is what a test theme upgrade this morning tells me: Downloading update from https://theme-updates.wpengine.com/twentysixteen/twentysixteen.3.3.zip… https://theme-updates.wpengine.com/twentysixteen/twentysixte... The risk I need to address is what's stopping Matt denying WPE access to that place where all the plugins and themes are published? Where does plugin-updates.wpengine.com get its content from, and how soon is Matt gonna block that? And an arms race of WPE needing to use proxies or other workarounds is not a business grade answer. As I see things, either 1) the "WordPress community" that Matt thinks he's fighting for step up and tells him "No thanks, we absolutely do not want you to fight this fight" and removes him from power, 2) WPE wins the court case and a judge tells Matt "Nope, you're wrong about trademark law and you're wrong about the GPL and you are going to be held to the claims you made in the past about WordPress the software and WordPress the foundation and wordpress.org the software distribution and update service." or 3) We are witnessing the start of the end of WordPress being trusted to run almost half of the internet.
  - belorn 2y ago
    As a customer and user of WPEngine, what role do you see wordpress in that relationship? Generally when I buy things I try to take some consideration of the sub-contractors and suppliers to the supplier of service, but I am aware that I do not have a direct relationship with them. I doubt the courts will demand that WordPress foundation must provide servers and bandwidth indefinite and free of charge to anyone, especially when there is no contract between WPEngine and WordPress foundation. When Youtube removed API functionality and under a night destroyed companies that relied on those free API's, courts did not demand that Youtube went back. It is inherently risky for companies to depend on someone else servers and network service being provided for free without any contract. The more easy path forward would be for WPEngine to switch dependency. Debian has an reliable repository. Core wordpress is already packaged there, it get updates, and a handful of the most popular themes are also packaged. If that is not enough then WPEngine could spend employee hours to package more themes. No need for proxies or workarounds. I would estimate that 90% of the customers on WPEngine could continue to exist using just that.
    - 2y ago
nsonha 2y ago
Is the plugin repo open source? If so then similar to VS Code, the community can spin up their own marketplace.
beaconify 2y ago
Over stated. Just go to hostgator or one of the million clones and select to auto update or use a plugin to do it. Also use the backup plugin. The real issue is if WP gets fractured or abandoned or weird license issues etc. Then I take my luggage to hugo or similar.
- hammyhavoc 2y ago
  Having a backup to restore from is not really the major concern versus mitigating being hacked in the first place, having your database stolen, and needing to report that, whilst surviving the reputational damage and penalty fees that likely brings. A restorable backup isn't really a priority versus the above.

mingus88 2y ago

The update issue doesn’t sound like a big deal. What’s stopping WP Engine from setting up their own mirror system? CentOS did this to Redhat for decades. They literally stripped out the trademarks and distributed the OS to anyone with no contracts at all. Patches were available same day that RH published them, and were applied from CentOS update servers. The endgame for WP seems to be that they give up this fight or close their source and act like a real licensed software company. You can’t play GPL until it no longer suits you, then start making insane demands about revenue sharing and all this nonsense.

bigiain 2y ago
WPEngine do have their own mirrors. This is what a test theme upgrade this morning tells me: Downloading update from https://theme-updates.wpengine.com/twentysixteen/twentysixteen.3.3.zip… https://theme-updates.wpengine.com/twentysixteen/twentysixte... The risk I need to address is what's stopping Matt denying WPE access to that place where all the plugins and themes are published? Where does plugin-updates.wpengine.com get its content from, and how soon is Matt gonna block that? And an arms race of WPE needing to use proxies or other workarounds is not a business grade answer. As I see things, either 1) the "WordPress community" that Matt thinks he's fighting for step up and tells him "No thanks, we absolutely do not want you to fight this fight" and removes him from power, 2) WPE wins the court case and a judge tells Matt "Nope, you're wrong about trademark law and you're wrong about the GPL and you are going to be held to the claims you made in the past about WordPress the software and WordPress the foundation and wordpress.org the software distribution and update service." or 3) We are witnessing the start of the end of WordPress being trusted to run almost half of the internet.
- belorn 2y ago
  As a customer and user of WPEngine, what role do you see wordpress in that relationship? Generally when I buy things I try to take some consideration of the sub-contractors and suppliers to the supplier of service, but I am aware that I do not have a direct relationship with them. I doubt the courts will demand that WordPress foundation must provide servers and bandwidth indefinite and free of charge to anyone, especially when there is no contract between WPEngine and WordPress foundation. When Youtube removed API functionality and under a night destroyed companies that relied on those free API's, courts did not demand that Youtube went back. It is inherently risky for companies to depend on someone else servers and network service being provided for free without any contract. The more easy path forward would be for WPEngine to switch dependency. Debian has an reliable repository. Core wordpress is already packaged there, it get updates, and a handful of the most popular themes are also packaged. If that is not enough then WPEngine could spend employee hours to package more themes. No need for proxies or workarounds. I would estimate that 90% of the customers on WPEngine could continue to exist using just that.
  - 2y ago

nsonha 2y ago

Is the plugin repo open source? If so then similar to VS Code, the community can spin up their own marketplace.

beaconify 2y ago

Over stated. Just go to hostgator or one of the million clones and select to auto update or use a plugin to do it. Also use the backup plugin. The real issue is if WP gets fractured or abandoned or weird license issues etc. Then I take my luggage to hugo or similar.

hammyhavoc 2y ago
Having a backup to restore from is not really the major concern versus mitigating being hacked in the first place, having your database stolen, and needing to report that, whilst surviving the reputational damage and penalty fees that likely brings. A restorable backup isn't really a priority versus the above.